AI Impact Assessment (AIIA)

A structured review of an AI system's potential harms, benefits and affected parties — required by ISO 42001 Annex A.

An AI Impact Assessment is a documented analysis of an AI system's intended use, affected individuals and groups, foreseeable harms (bias, safety, privacy, misuse), benefits and mitigations. ISO/IEC 42001 Annex A requires an AIIA per AI system or per use case. The assessment is updated when the system changes materially (new data, new users, new use cases) and is reviewed by a cross-functional team — product, engineering, legal, compliance. In regulated contexts (EU AI Act high-risk systems) the AIIA is one of the primary artefacts an auditor samples to test risk management and data governance obligations.

Examples

  • →A credit-decisioning model: AIIA documents affected applicants, protected-class disparate-impact testing, appeal process, human-in-the-loop threshold and audit log.
  • →A customer-support chatbot: AIIA documents scope (support-only), hallucination risk, fallback to a human agent, PII redaction and the review cadence.

Common mistakes

  • ✗Writing a single AIIA for the whole company. Impact is use-case specific; each production AI system needs its own.
  • ✗Treating the AIIA as one-off documentation. It must be re-reviewed on material model, data or deployment changes.

How LowerPlane handles it

LowerPlane provides an AIIA template plus an AI-system inventory so every production model has an owner, intended-use statement, risk tier and current assessment status.

Authoritative sources

Related reading on LowerPlane

Related terms

  • ISO/IEC 42001 — International standard for an Artificial Intelligence Management System (AIMS).
  • ISO 42001 Annex A — The 38 AI-specific controls that make ISO 42001 auditable — the AI analogue of ISO 27001 Annex A.
  • AIMS (AI Management System) — The policy, process and control stack that ISO 42001 certifies — the AI-governance analogue of an ISMS.
  • AI system lifecycle — The staged flow an AI system moves through from planning to decommissioning, each stage carrying its own controls under ISO 42001.
  • Data Protection Impact Assessment (DPIA) — A GDPR-required assessment of high-risk data processing before it starts.
← Back to the full glossary